Multiple allowUnfreePredicates should compose with or

[l0b0]

Describe the bug

Specifying nixpkgs.config.allowUnfreePredicate in two files, and then importing one from the other, results in only one of the allowUnfreePredicates taking effect. Instead, any package matching any allowUnfreePredicate should be allowed.

Steps To Reproduce

Steps to reproduce the behavior:

1. Specify imports = [./host.nix];, fonts.fonts = [pkgs.corefonts];, and

   nixpkgs.config.allowUnfreePredicate = pkg:
     builtins.elem (
       lib.getName pkg
     ) (
       map lib.getName [
         pkgs.corefonts
       ]
     );

   in /etc/nixos/configuration.nix
2. Specify

   nixpkgs.config.allowUnfreePredicate = pkg:
     (
       builtins.elem (
         lib.getName pkg
       ) (
         map lib.getName [
           pkgs.steam
           pkgs.steamPackages.steam
         ]
       )
     );

   and programs.steam.enable = true; in /etc/nixos/host.nix.
3. Run nixos-rebuild

This command will fail because only the /etc/nixos/configuration.nix allowUnfreePredicate is taken into account, so Steam can't be installed.

Expected behavior

Both pkgs.corefonts and pkgs.steam should be installed, analogous to how environment.systemPackages from imported packages are joined with local environment.systemPackages to install all of them.

Additional context

Workaround:

{
  config,
  lib,
  modulesPath,
  pkgs,
  specialArgs,
  options,
}: let
  imports = [
    /etc/nixos/cachix.nix
    /etc/nixos/root.nix
  ];
in {
  inherit imports;

  nixpkgs.config.allowUnfreePredicate = pkg:
    (builtins.elem (lib.getName pkg) [
      "bar"
    ])
    || builtins.any (
      path: let
        package = import path {
          inherit config lib modulesPath pkgs specialArgs options;
        };
      in
        if builtins.hasAttr "nixpkgs" package
        then package.nixpkgs.config.allowUnfreePredicate pkg
        else false
    )
    imports;
}

Notify maintainers

Metadata

• system: "x86_64-linux"
• host os: Linux 5.15.74, NixOS, 22.05 (Quokka), 22.05.3737.3933d8bb912
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.11.0
• channels(root): "home-manager-22.05.tar.gz, nixos-22.05"
• channels(victor): ""
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

[zarthross]

👍 I think this is a bit cumbersome as well.

I worked around this by creating this module:

{ config, pkgs, nixpkgs, lib, ... }:

let
  inherit (lib) mkOption types;
  cfg = config.allowedUnfreePackagesRegexs;
in {
  options = {
    allowedUnfreePackagesRegexs = mkOption {
      default = [ ];
      type = types.listOf types.str;
      description = "List of unfree packages allowed to be installed";
      example = lib.literalExpression ''[ "steam" ]'';
    };
  };

  config = {
    nixpkgs.config.allowUnfreePredicate = pkg:
      let pkgName = (lib.getName pkg);
          matchPackges = (reg: ! builtins.isNull (builtins.match reg pkgName));
      in
        builtins.any matchPackges cfg;
  };
}

and then I can use it like this:

allowedUnfreePackagesRegexs = [ "slack" "discord" ]; 
# in another config file:
allowedUnfreePackagesRegexs = ["nvidia-.*"];

[turion]

The issue, if I understand it correctly, is that nixpkgs.config is not handled as modules like other options. So the typical merging algorithm is not applied. Or at least, I can't find any place where this option is declared.

[Majiir]

I use this module:

{ lib, config, ... }:
{
  options = with lib; {
    nixpkgs.allowUnfreePackages = mkOption {
      type = with types; listOf str;
      default = [];
      example = [ "steam" "steam-original" ];
    };
  };

  config = {
    nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) config.nixpkgs.allowUnfreePackages;
  };
}

I have nixpkgs.allowUnfreePackages declared in multiple modules, and they merge just fine.

[bjornfor]

I use this module:

Submit PR?

[ejiek]

I've successfully used the module by @Majiir for some time now (thanks for sharing it ).

There is a braking change though.
Since #257458 nixpkgs.config is not welcomed in config when pkgs is used.
Unfortunately, I don't understand this module well enough to update it.
So just bringing here that it might no longer work.

[Majiir]

I don't think that's an issue with the module, since you will need to set nixpkgs.config regardless to set allowUnfreePredicate. From the PR you linked, the assertion says:

Your system configures nixpkgs with an externally created instance. nixpkgs.config options should be passed when creating the instance instead.